Disable an account automatically

Question

Hi everybody,
I think I misunderstood something about disabling an account automatically.
I retrieve datetime attribute from HCM system and set up MX_VALIDTO attribute (MX_PERSON entrytype). I believed that when the MX_VALIDTO is reached, some how MX_DISABLE is assigned to the user and  task to disable the account is triggered. But nothnig happens in my case.
I must be missing something..
Do I have to make a script to trigger a custom task that assign MX_DISABLE to the account?
Thanks
Guillaume

Answer 1

Hi,
Which source attribute in HCM do you use to calculate/setup MX_VALIDTO date?
The scenario you described happens when a user status (STAT2) has changed in HCM, in this case from Active to Withdrawn. In the IDM default framework this attribute is mapped to MX_LOCKED. This is a global attribute just like MX_DISABLED.
The MX_VALIDTO attribute doesn't trigger any events to disable an Identity unless you configure it using e.g. a task linked to the attribute Event handling, configure the Modify Validity on the repository or a Custom Job that runs daily after midnight to retrieve all expired users.
I use MX_VALIDTO for temp-contractors because IdM is the single source of truth but never do this for permanent employees. For employees I have a process that checks the status when a user has changed in the HCM load and set the MX_DISABLED attribute if the user has been withdrawn.
MX_DISABLED will trigger events to disable all accounts in target systems but will not remove Business Roles from IdM. You need to include this in your termination process.
I hope these help!.
Regards,
Ridouan